TCP/IP protocol stack detailed

TCP/IP protocol family 1.1 Introduction

The TCP/IP protocol family consists of 5 layers: Physical layer, Data link layer, network layer, Transport layer and application layer. The first four layers correspond to the first four layers of the OSI model, providing physical standards, network interfaces, Internet connectivity, and transport capabilities. The application layer corresponds to the highest three layers in the OSI model.

Each layer in the TCP/IP protocol family contains some relatively independent protocols. At the physical and data link layers, TCP/IP does not define any protocols. In the network layer TCP/IP supports Internet Protocol (IPS), and IP is composed of four support protocols: ARP, RARP, ICMP, and IGMP. Traditionally, the TCP/IP protocol family has two transport protocols in the Transport Layer: TCP and UDP, but now a new transport layer protocol SCTP has been designed to meet the needs of new applications. IP is the host to the host protocol, that is, the packet from one physical device to another physical device. UDP and TCP are transport protocols that are responsible for delivering messages from one process (the running program) to another. 1.2 Address

The Internet using the TCP/IP protocol uses 3-level addresses: Physical (link) address, logical (IP) address, and port address. Each address belongs to a specific layer in the TCP/IP architecture. 1.2.1 Physical Address

The physical address is also called a link address, which is the address of the node, defined by its local area network or WAN. The physical address is contained in the frame used by the data link layer.

The Ethernet address is 6 bytes (48-bit) long, usually in hexadecimal notation, such as: 07:01:02:01:2c:4b. There are 3 types of Ethernet addresses: unicast, multicast, and broadcast. The lowest bit 0 of the first byte in a unicast address; the lowest digit of the first byte in the multicast address is 1. The broadcast address is 48 1.

1.2.2 Logical Address

The logical address of the Internet is a 32-bit address that can be used to flag each host connected to the Internet. No two hosts have the same IP address on the Internet. Similarly, a logical address can be a unicast address, a multicast address, and a broadcast address.

The internet is separated into many network segments by a variety of routers and gateway devices, in order to identify different network segments, the 32-bit IP address needs to be divided into the network number and host number two parts, the same network number of hosts in the same network segment, can communicate with each other, network number of different host communication between the need to forward through the router. Divide all IP addresses into five categories, as shown in Figure 1 below:

Class A 0.0.0.0 to 127.255.255.255
Class B 128.0.0.0 to 191.255.255.255
Class C 192.0.0.0 to 223.255.255.255
Class D 224.0.0.0 to 239.255.255.255
Class E 240.0.0.0 to 247.255.255.255

The IP address can be divided into Net-id (Network identification) and Host-id (host identification) in Category A, Class B, Class C addresses. For Class A addresses, the 1-byte definition Net-id and the 3-byte definition Host-id. For Class B addresses, the 2-byte definition net-id,2 byte definition Host-id. For Class C addresses, the 3-byte definition Net-id and the 1-byte definition Host-id. Class D addresses and class E addresses do not divide Net-id and Host-id.

A network address is the first address of an address block that defines the network to the rest of the Internet. A router chooses the routing of a group based on its network address. Given the network address, we can find the class, address block, and address range of this address block.

This partitioning scheme has great limitations, and its division of the network is flat rather than hierarchical (hierarchical). Each router on the Internet must master all the network information, with the advent of a large number of C-class networks, routers need to retrieve more and more routing tables, more and more heavy burden.

Then proposed a new division scheme, called CIDR (Classless interdomain Routing). The partition of the network number and host number needs to be represented by an additional subnet mask (subnet mask). It cannot be determined by the numeric value of the IP address itself, that is to say, the division of the network number and host number is independent of the IP address of Class A, Class B, or Class C, so it is called classless. In this way, multiple subnets can be rolled up (summarize) into a network on the Internet. IP address and subnet mask do and operation can get the network number, the host number from 0 to all 1 is the subnet address range. There is also a more concise representation of the IP address and subnet mask, such as 140.252.20.68/24, which represents an IP address of 140.252.20.68, and a height of 24 bits of the subnet mask 1, or 255.255.255.0.

The destination address is 255.255.255.255, which represents the internal broadcast of the network, and routers do not forward such broadcast packets. The destination address has a host number of 1, indicating that all hosts broadcast to a network, such as the destination address 192.168.10.255, represent broadcasts to the 192.168.10.0 network (assuming the subnet mask is 255.255.255.0). 1.2.3 Port Address

A computer is a multiple-process device that can run multiple processes at the same time. The ultimate goal of Internet communication is to enable a process to communicate with another process. In order to be able to happen at the same time, there needs to be a way to label different processes, meaning that these processes require addresses.

In the TCP/IP architecture, the label assigned to a process is called the port address. The port address in TCP/IP is 16-bit long and is usually represented by a 10-digit number.

1.3 Introduction to tiered data packages

1.3.1 Ethernet Frame
The destination address (DA) DA field has 6 bytes and is the physical address (also called the MAC address) of the next station.

The source address (SA) sa field has 6 bytes and is the physical address of the previous station.

Type Type field has three kinds of values, corresponding IP, ARP, RARP.

Data carries data encapsulated from the upper layer protocol. Its minimum length is 46 bytes, and the maximum length is 1500 bytes. ARP, Rarp packet length is not enough 46 bytes, to fill in the back padding bit. A maximum of 1500 is called the Maximum Transmission Unit (MTU) of an Ethernet, and if a packet is routed from Ethernet to the link, the packet length is greater than the link's MTU, the packet needs to be fragmented

CRC error detection information, 4 bytes. 1.3.2 ARP Message format


A hardware type 16-bit field that defines the type of link layer network that is running ARP. Ethernet is type 1.

Protocol type 16-bit field, refers to the type of address to convert. 0x0800 bit IP address.

Hardware length 8-bit field that defines the length of the physical address in bytes. For Ethernet this value is 6.

Protocol length 8-bit field that defines the length of the logical address in bytes. The value for the IPV4 protocol is 4.

Manipulate 16-bit fields to define the type of grouping. Represents an ARP Request for 1 and an ARP response for 2.

The sender-side hardware address variable-length field, which defines the physical address of the sending end.

The sender-side protocol address defines the logical address of the sender.

The destination hardware address defines the physical address of the destination. For ARP Request messages, this field is all 0 because the sender does not know the physical address of the destination.

The destination protocol address defines the destination's logical (e.g., IP) address. 1.3.3 IP Data message format
Version (VER) This 4-bit field defines the version of the IP protocol.

Header Length (Hlen) This 4-bit field defines the total IP header length, calculated in 4 bytes. When there is no option, the header length is 20 bytes, and the value of this field is 5 (5*4=20). The value of this field is 15 (15*4=60) When the value of the selected key is maximum.

The service type (DS) TOS bit is a 4-bit child field with 5 different service types.

Total length This 16-bit field defines the total length of the datagram in bytes (the header plus the data). To find out the length of the data from the upper level, you can subtract the first minister from the total length. The total Length field is 16 bits, so the length limit for the IP datagram is 65535 (216-1) bytes.

Identity (identification) This 16-bit field uniquely defines this datagram with the source IP address. The IP protocol uses a counter to flag datagrams, and when the IP protocol sends the data, it copies the current value of the counter to the Identity field and adds 1. When the datagram is fragmented, the value of the identity field is copied to all slices. In other words, all the fragments have the same identification number, that is, the identification number of the original datagram. At the end of the reload data, the endpoint knows that all fragments with the same identification number must be assembled into a datagram.

Flag (Flags) 3-bit field. First reservation. The second digit is not a fragment bit, and 1 means that the datagram is not fragmented; 0 indicates that the datagram is fragmented when needed. The third digit is the fragment bit, and 1 indicates that the datagram is not the final fragment, and then there is a fragment; 0 indicates that the datagram is the last fragment.

Fragment offset (fragmentoffset) This 13-bit field represents the relative position of the fragment in the entire datagram, measured in 8 bytes.

The live Time (TTL) is used to control the maximum number of route hops passed by the datagram, which is not a second, but a hop.

Protocol This 8-bit field defines a high-level protocol that uses IP layer services. such as: TCP, UDP, ICMP and IGMP and so on.

Tests in the test and IP groupings and only in the header and not in the data section. Because, all high-level protocols that encapsulate data in IP datagrams have a test that covers the entire packet, and secondly, each router, the header of the IP datagram is changed once, but the data part is unchanged. Therefore the test and only the change of the part of the test.

Source address this 32-bit field defines the IP address of the source point. This field must remain unchanged during the time the IP datagram is sent from the source host to the destination host.

Destination address this 32-bit field defines the IP address of the endpoint. This field must remain unchanged during the time the IP datagram is sent from the source host to the destination host. 1.3.4 ICMP message format

Type 8-bit field that defines the type of ICMP message. ICMP message types are: Endpoint unreachable, source-point suppression, timeout, parameter problems, change routing, loopback request or answer, timestamp request or answer, address mask request or answer, router inquiries, and notifications.

Code 8-bit field that indicates the reason for sending this particular message type.

Check and (icmpchksum) 16-bit field. In ICMP, the tests and calculations cover the entire message (header and data).

The ICMP echo request or answer message header format is shown in the following illustration:

ICMP Endpoint Unreachable message header format as shown in the following illustration:

The ICMP super-times header format is shown in the following illustration:

1.3.5 IGMP message format

Type 8-bit field, defines query, member relation report, exit report three kinds of message type, the type value is 0x11, 0x16, 0x17 respectively. The maximum response time 8-bit field defines how long the query must answer. Its value is in One-tenth-second units. This value is not 0 in the query message, but is zero in the other two messages.

Test and 16-bit fields, check and compute on 8-byte packets.

Group address in the General query message the value of this field is 0, in special query message, Member Relationship report message and exit report message to define GROUPID (group multicast address).
1.3.6 UDP User Datagram header format

The UDP datagram format is shown in the figure above.

The user datagram has a fixed header of 8 bytes.

The source port number 16-bit field that defines the port number used by the process running on the source host.

Destination port number 16-bit field that defines the port number used by processes running on the destination host.

Length 16-bit field that defines the total length of the user datagram and the header plus the data. Inspection and 16-bit field, UDP verification and includes three parts: pseudo header, UDP header, and data from the application layer. The bit header is part of the header of the IP packet, including the source IP address, Destination IP address, 8-bit protocol, and 16-bit UDP total length. The bit header guarantees that the user datagram can be delivered to the correct host when the IP header is damaged. The join of the Protocol field ensures that the grouping belongs to UDP rather than TCP.

1.3.7 TCP Message segment format

As shown in the figure above, the structure of the TCP segment consists of:

Source port Address This 16-bit field defines the application port number where the message segment is sent.

Destination port Address This 16-bit field defines the application port number that receives the message segment.

Ordinal this 32-bit field defines a number assigned to the first data byte in this paragraph. To ensure connectivity, each byte to be sent is numbered. The sequence number tells the endpoint, which byte in the series is the first byte in the message segment. When the connection is established, each party uses a random number generator to produce the initial ordinal number (ISN).

The confirmation number 32-bit field defines the next sequence number that the message segment receiver expects to receive from the other side. If the receiver of the message segment successfully sends the serial number x sent by the other, it defines the confirmation number as x+1.

Header Length (Tcpoffset) 4-bit field that indicates how many 4-byte words a TCP header has. That is, the offset size of the TCP data in the IP data. With the IP head of the ministerial degree, can be between 5 and 15.

The reserved bit of the 6-bit field is left for future use.

Control/Flag bit This field defines 6 different control bits or flags, at the same time you can set one or more bit flags.

Window value This field defines the window values (in bytes) that the receiver must maintain. Note that the field is 16 bits long, so the maximum length of the window value is 65535 bytes. This value is determined by the receiving end, and the sender must obey the decision of the receiving end.

The test and this 16-bit field contains the test and the TCP usage test and is mandatory.

Emergency pointer when the location of the emergency flag position, this 16-bit field is valid, when the message segment includes emergency data. The emergency pointer defines a number, which is added to the ordinal to arrive at the last critical byte in the Segment data section.

Options include no operation (NOP), maximum segment Length (MSS), window enlargement factor, timestamp, and so on.

1.4 Layered Protocol Tutorial

In general, the TCP/IP protocol's multipath selection process can be represented as the following illustration:

1.4.1 Arp and RARP 1.4.1.1 Address Resolution Protocol ARP

At any given time, when a host or router is reported to be sent to another host or router, it must have a logical (IP) address at the receiving end. However, IP datagrams must be encapsulated into frames to pass through the physical network. This means that the sender must have a physical address at the receiving end, and therefore a mapping from the logical address to the physical address is required.

The Address Resolution Protocol (ARP) is used to associate an IP address with its physical address. Any time a host or router needs to find the physical address of another host or router on the network, it sends an ARP query packet. This grouping includes the physical address and IP address of the sender and the IP address of the receiving end.

Because the sender does not know the physical address of the receiving end, the query is broadcast on the network. For example, a packet is sent to a host with an IP address of 192.168.0.1, the procedure is as follows:

The source host sends an ARP request asking "What is the hardware address of the 192.168.0.1 host" and broadcasts the request to the local network segment (the hardware address of the Ethernet frame header fills FF:FF:FF:FF:FF:FF for broadcast), and the destination host receives the broadcast ARP request, If the IP address is found to be the same as this one, send an ARP reply packet to the source host and fill in the answer package with your hardware address.

The ARP message format is as described earlier.

The ARP package consists of 5 components:

Cache table:

Each host maintains an ARP cache table, because the cache table has very limited space, the table entries in the cached table have an expiration time (typically 20 minutes), and if a table entry is not used again within 20 minutes, the table entry is invalidated and the next time an ARP request is sent to obtain the hardware address of the destination host.

Queues:

Queues are used to preserve IP groupings when ARP attempts to resolve hardware addresses. The output module sends unresolved packets to the corresponding queue, and the input module takes a packet from a queue and sends it along with the parsed physical address to the data link layer for transmission.

Output module:

The output module waits for IP packets from the IP software. The output module checks the cache table to see if there is an item that corresponds to the destination IP address for this group. The destination IP address of this IP packet must match the protocol address of this project.

Input module:

The input module waits until an ARP group arrives. Check the cache table for items that correspond to this ARP group. The input module sets the timeout period for this project time-out. If the queue is empty, the group is removed from the corresponding queue one after another, along with its hardware address to the data link layer.

High -Speed cache control module:

Responsible for maintaining the cache table, which periodically checks the cache table to determine which items expire and which queues need to be revoked. 1.4.1.2 Inverse Address Resolution Protocol Rarp

When a host knows its own physical address, rarp can be used to find its logical address. Each host or router is assigned one or more logical addresses that have nothing to do with the physical address of the machine. To create an IP datagram, the host or router needs to know its own IP address. You can use the RARP protocol to obtain a logical address from a physical address.

Once you know the physical address, create the RARP request and broadcast on the local network. Another machine on the local network knows all the IP addresses, and it responds with a rarp answer. The requested machine must run the RARP client, and the responding machine must run the RARP server program. 1.4.2 IP Protocol

The format of the IP datagram is as described earlier.

IP is an unreliable connectionless protocol that is responsible for the delivery of the source point to the endpoint.

The packet at the IP layer is called the datagram.

The data link layer has its own frame format, in which a field is the maximum length of the data field. When a datagram is encapsulated in a frame, the total length of the datagram must be less than the maximum length (MTU) of the data field.

Segmenting a datagram is called fragmentation. Source stations typically do not fragment IP groupings. The transport layer will be fragmented, dividing the data into IP and the size that may be accepted in the data link layer being used. The datagram can be fragmented several times before it reaches the end point and can be fragmented by the source host or any router on its path. However, the reorganization of the datagram can only be done on the destination host.

Tests in IP groupings and only in the header rather than in the data part of the heart. Because, first of all the high-level protocol that encapsulates data in an IP datagram, there is a test that covers the entire packet; second, every time a router passes, the header of the IP datagram is changed once, but the data part is unchanged. Therefore the test and only the change of the part of the test.

The IP package consists of 8 components: the header addition module, the processing module, the forwarding module, the fragment module, the Reload module, the routing table, the MTU table, and the reload table, as well as the input and output queues.

The header adds the module, receives the data from the high-level Protocol (along with its IP address), after adding the IP header, encapsulates the data into the IP datagram.

The processing module receives the datagram from an interface or from the header, first checking whether the datagram is a loopback address, or the group has reached its final destination.

Input queues store data from a data link layer or from a high-level protocol.

The output queue stores the datagram to be sent to the data link layer or the high-level protocol, the processing module extracts the datagram, and the fragment and reload module adds the datagram to the output queue.

The routing table is used in the forwarding module to determine the next hop address for a group.

The fragment module receives the IP datagram from the forwarding module. The forwarding module gives the IP datagram and the IP address of the next station. And the number of calls that must be passed to send the datagram. The fragment module uses the MTU table to identify the maximum Transfer unit MTU for a particular interface. If the datagram is longer than the MTU, the fragment module slices The datagram, adds a header for each fragment, and sends them to the ARP package for address resolution and delivery.

The reload module receives a datagram fragment from the processing module that has reached its final destination. The reload module sees the fragmented datagram as belonging to only one fragment of the datagram. Use the Reload table to find out which datagram a fragment belongs to, sort the slices that belong to the same number, and reassemble them into a datagram when all the fragments arrive. 1.4.3 ICMP protocol

IP protocol has no error reporting or error correction mechanism and management query mechanism. Internet Control Message Protocol (ICMP) is designed to compensate for these two shortcomings. It is used in conjunction with the IP protocol.

CMP itself is a network layer protocol, but its messages are not transmitted directly to the data link layer as intended, but are first encapsulated into an IP datagram and then sent to the next level. The Protocol field value in the IP datagram is 1 to indicate that its IP data is an ICMP message.

The ICMP message types are shown in table 2-2 below:


1.4.4 IGMP Protocol

Internet Group Management Protocol (IGMP) is a necessary, but not sufficient, protocol for multicast. IGMP is not a multicast routing protocol, but a protocol that manages group membership. Whenever a host needs to join or leave a particular multicast group, the Protocol allows the host to notify neighboring routers.

This protocol is used only on the network between the host and the router. Also, the protocol defines only the computer (not the application process) as a group member.

If multiple processes are to be added to a multicast group on a given computer, the computer must copy multiple copies of each datagram received to each process. Only when the last process leaves the group does the computer use IGMP to notify the local router that it is no longer a member of the group. IGMPV2 has 3 types of messages: query, membership report, and exit report.

IGMP can be divided into two phases:

Phase one: When a host joins a new multicast group, the host sends an IGMP message to the multicast group's multicast address stating that it wants to be a member of the group. After the local multicast router receives the IGMP message, the group member relationship is forwarded to other multicast routers on the Internet.

Phase two: Because the group membership relationship is dynamic, local multicast routers periodically inquire about hosts on the local LAN to see if they are also contiguous members of groups. As long as there is a host response to a group, the multicast router considers the group to be active. However, a group does not have a host response after multiple inquiries, and the multicast routers assume that the hosts on this network have left the group so that the membership of the group is no longer forwarded to other multicast routers.

The IGMP message format is as described earlier.

Advantages of the IGMP protocol:

1. All communications between host and multicast routers use IP multicast, and whenever possible, datagrams carrying IGMP messages are transmitted using hardware multicasting.

2. Multicast routers only need to send one query to all multicast groups when exploring group membership, instead of sending a single query to each group, the default is 125S once. 1.4.5 UDP Protocol

The format of the UDP datagram is as described earlier.

UDP sits between the application layer and the IP layer as intermediaries for application and network operations.

IP is responsible for computer-level communication (host to host communication), as a network layer protocol, IP can only deliver messages to the destination host. However, this is an incomplete delivery. This message must also be sent to the correct process. UDP is responsible for the delivery of messages to the appropriate process.

The most common way to complete communication between processes and processes is through the client-server paradigm. A process called a client on the local host initiates a request, and a process called a server on a remote host passively waits for, receives, and responds to requests. The client's IP address and port number uniquely identify the client process on that host, and the server's IP address and port number uniquely identify the service-side feed on that host. Because the client is the party that initiates the request, it must know the IP address of the server and the port number of the service process, so some common network protocols have default server ports. In the TCP/IP protocol family, the port number is an integer between 0~65535. ICANN divides the port number into 3 areas: familiarity with port numbers, registered port numbers, and dynamic (or private) port numbers.

Familiar with port range from 0~1023, registering port range from 1024~49151, dynamic port range from 49152~65535.

It is known that UDP requires two identifiers, which are IP addresses and port numbers, and are used at one end to establish a connection. An IP address and a port number together are called socket addresses. This information is part of the IP header and UDP header.

UDP provider connection service, that is, every user datagram sent by UDP is a separate datagram, each user datagram can take a different path to reach the destination. UDP lacks flow control and error control.

To send a message from one process to another, the UDP protocol encapsulates and assembles the message.

1. Package

When the process has a message to be sent through UDP, it will send this message together with a pair of socket address and the length of the data to UDP, plus the UDP header, UDP, the user datagram with the socket address passed to the IP. IP plus its own header, use the value 17 in the Protocol field to indicate that the data came from the UDP protocol. The IP datagram is then passed to the data link layer, and the data link layer receives the IP datagram, plus its own header is passed to the physical layer. The physical layer encodes these bits into electrical signals or light signals and sends them to the remote machine.

2. Disassembly

When the message arrives at the destination host, the physical layer decodes the signal, turning it into a bit and passing it to the data link layer. The data link layer uses this header (and tail) to check the data. If there is no error, then remove the first and the tail, and the datagram passed to the IP. IP software to check, if there is no error, stripped the first, the user datagram together with the sender and receiver IP address to pass to UDP. UDP uses the test and checks the entire user datagram. If no error is stripped of the first, the application data passed to the receiving process. When you need to answer the received message, you should pass the socket address of the sender to the receiving process.

The UDP package consists of 5 components: a control block table, several input queues, a control block module, an input module, and an output module. In UDP, queues are associated with ports. The implementation here creates only the input queues associated with each process, without creating an output queue.

3. Control block Table

The UDP control block table to record open ports. Each item in the table has a minimum of 4 fields: status (Free or in-use), process ID, port number, and corresponding queue number.

4. Input queue

A set of input queues is used, each corresponding to a process.

5. Control block Module

Responsible for managing the control block table. When the process is started, it requests a port number from the operating system. The operating system assigns a well-known port number to the server and assigns a short port number to the customer. The process passes the process ID and port number to the control block module to create a project for the process in the table. This module does not create queues. The queue number segment value is zero.

6. Input module input module receives user datagram from IP. It looks up the control block table and looks for items that have the same port number as this user datagram. If you find such a project, the module will use the information in this project to put this data into the queue. If no such item is found, it generates an ICMP "Port unreachable" message and discards the project.

7. Output module

Responsible for creating and sending user datagrams. 1.4.6 TCP Protocol

TCP is called a connection-oriented, reliable transport protocol. It provides process to process, Full-duplex, and connection-oriented services. TCP uses the sliding window mechanism to achieve flow control to avoid overload of the receiving end due to excessive data and to use error control to provide reliable service.

The data units that are transmitted using TCP software between the two devices are called message segments, which have the header of the 20~60 byte, followed by the data from the application. The first structure is as described earlier.

1.4.6.1 TCP Connections

TCP connections usually consist of 3 phases: connection establishment, data transfer, and connection termination.

A three-direction handshake is required for connection creation :

1. The customer sends the first message segment, the SYN segment, in which only the SYN flag position is 1. The function of this message segment is to synchronize the serial number. The SYN segment is a control segment that does not carry any data, but consumes an ordinal number. When the data transfer starts, each byte is sent, and the ordinal number should be 1. In the receiving end can be based on the number of packets to discharge the correct order, you can also find the case of packet loss.

2. The server sends a second message segment, a syn+ack message segment, and two flag locations 1 (SYN and ACK). The server uses this segment to synchronize the initial sequence number to send bytes from the server to the customer. Use ACK to confirm that a SYN message segment has been received from the client, and the confirmation number sends the SYN message segment ordinal value plus 1.

3. The customer sends the third message ACK, confirming the number to send the message segment ordinal value plus 1. The sequence number of the message segment is the same as the serial number used for the SYN segment.

The ACK segment does not consume serial numbers if it does not carry data.

After the connection is established, the data begins to transfer in both directions :

In the process of data transmission, ACK and acknowledgement sequence number is very important, the data sent by the application to the TCP protocol will be sent to the TCP layer in the send buffer, sending packets to the other side, only to receive the reply of the ACK segment to know that the packet is actually sent to the other side, can be released from the send buffer, If the packet is lost due to a network failure or the ACK segment is lost, the TCP protocol automatically resend the packet in the send buffer after the wait timeout.

The above situation only describes the simplest one-answer scenario, the fact that the TCP protocol provides a Full-duplex (Full-duplex) service for the application layer, both of which can send data to each other both proactively and simultaneously. If the communication process can only be used in a single answer, receive and send two directions can not be transmitted at the same time, in